Alawn/Druid
1
0
Fork 0
mirror of https://github.com/alibaba/druid.git synced 2023-03-04 19:17:16 +00:00
Code Issues Releases Wiki Activity

improve wall filter

Browse Source
This commit is contained in:
wenshao
2013-04-01 20:52:37 +08:00
parent 032c5762e2
commit 1e35c47986
3 changed files with 39 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/alibaba/druid/sql/ast/statement/SQLAlterTableStatement.java
-1
View File
@@ -20,7 +20,6 @@ import java.util.List;
import com.alibaba.druid.sql.ast.SQLName;
import com.alibaba.druid.sql.ast.SQLStatementImpl;
import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlASTVisitor;
import com.alibaba.druid.sql.visitor.SQLASTVisitor;
public class SQLAlterTableStatement extends SQLStatementImpl implements SQLDDLStatement {
src/main/java/com/alibaba/druid/wall/WallConfig.java
+18
View File
@@ -41,9 +41,11 @@ public class WallConfig implements WallConfigMBean {
private boolean deleteAllow = true;
private boolean deleteWhereAlwayTrueCheck = true;
private boolean deleteWhereNoneCheck = false;
private boolean updateAllow = true;
private boolean updateWhereAlayTrueCheck = true;
private boolean updateWhereNoneCheck = false;
private boolean insertAllow = true;
private boolean mergeAllow = true;
@@ -351,6 +353,14 @@ public class WallConfig implements WallConfigMBean {
public void setDeleteWhereAlwayTrueCheck(boolean deleteWhereAlwayTrueCheck) {
this.deleteWhereAlwayTrueCheck = deleteWhereAlwayTrueCheck;
}
public boolean isDeleteWhereNoneCheck() {
return deleteWhereNoneCheck;
}
public void setDeleteWhereNoneCheck(boolean deleteWhereNoneCheck) {
this.deleteWhereNoneCheck = deleteWhereNoneCheck;
}
public boolean isUpdateAllow() {
return updateAllow;
@@ -368,6 +378,14 @@ public class WallConfig implements WallConfigMBean {
this.updateWhereAlayTrueCheck = updateWhereAlayTrueCheck;
}
public boolean isUpdateWhereNoneCheck() {
return updateWhereNoneCheck;
}
public void setUpdateWhereNoneCheck(boolean updateWhereNoneCheck) {
this.updateWhereNoneCheck = updateWhereNoneCheck;
}
public boolean isInsertAllow() {
return insertAllow;
}
src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
+21 -16
View File
@@ -225,14 +225,18 @@ public class WallVisitorUtils {
public static void checkDelete(WallVisitor visitor, SQLDeleteStatement x) {
checkReadOnly(visitor, x.getExprTableSource());
if (!visitor.getConfig().isDeleteAllow()) {
WallConfig config = visitor.getConfig();
if (!config.isDeleteAllow()) {
addViolation(visitor, "delete not allow", x);
return;
}
if (x.getWhere() == null
|| Boolean.TRUE == getConditionValue(visitor, x.getWhere(),
visitor.getConfig().isDeleteWhereAlwayTrueCheck())) {
if (x.getWhere() == null && config.isDeleteWhereNoneCheck()) {
addViolation(visitor, "delete none condition not allow", x);
return;
}
if (Boolean.TRUE == getConditionValue(visitor, x.getWhere(), config.isDeleteWhereAlwayTrueCheck())) {
addViolation(visitor, "delete alway true condition not allow", x);
return;
}
@@ -416,25 +420,26 @@ public class WallVisitorUtils {
public static void checkUpdate(WallVisitor visitor, SQLUpdateStatement x) {
checkReadOnly(visitor, x.getTableSource());
if (!visitor.getConfig().isUpdateAllow()) {
WallConfig config = visitor.getConfig();
if (!config.isUpdateAllow()) {
addViolation(visitor, "update not allow", x);
return;
}
if (visitor.getConfig().isUpdateWhereAlayTrueCheck()) {
if (x.getWhere() == null) {
if (x instanceof MySqlUpdateStatement) {
MySqlUpdateStatement mysqlUpdate = (MySqlUpdateStatement) x;
if (mysqlUpdate.getLimit() == null) {
addViolation(visitor, "update none condition not allow", x);
return;
}
} else {
if (x.getWhere() == null && config.isUpdateWhereNoneCheck()) {
if (x instanceof MySqlUpdateStatement) {
MySqlUpdateStatement mysqlUpdate = (MySqlUpdateStatement) x;
if (mysqlUpdate.getLimit() == null) {
addViolation(visitor, "update none condition not allow", x);
return;
}
} else {
addViolation(visitor, "update none condition not allow", x);
return;
}
}
if (config.isUpdateWhereAlayTrueCheck()) {
if (Boolean.TRUE == getConditionValue(visitor, x.getWhere(), true)) {
addViolation(visitor, "update alway true condition not allow", x);
return;
@@ -843,11 +848,11 @@ public class WallVisitorUtils {
WallSqlTableStat tableStat = context.getTableStat(tableName);
if (tableStat != null) {
SQLObject parent = x.getParent();
while (parent instanceof SQLTableSource) {
parent = parent.getParent();
}
if (parent instanceof SQLSelectQueryBlock) {
SQLSelectQueryBlock queryBlock = (SQLSelectQueryBlock) parent;
if (x == queryBlock.getInto()) {